The BB84 QBC protocol by Bennett and Brassard [1] is quite similar to the well-known BB84 QKD protocol:

- BB84 Quantum Bit Commitment Protocol
^{2}

- 1.
- Commitment Phase
- (a)
*A*chooses her bit*b*and*s*random bits . Then proceeds to send*s*particles to*B*, each one encoding*b*_{i}with respect to the basis (if*b*=0) or (if*b*=1)- (b)
*B*chooses*s*random bits and measures the qubits received with respect to the basis (when ) or (when ).

- 2.
- Disclosure Phase
- (a)
*A*reveals*b*and .*B*verifies that*b*was measured for all*i*such that .

b |
b_{i} |
qubit sent | measurement basis | P(0 measured) | P(1 measured) | |

0 | 0 | 0 | 1 | 0 | ||

0 | 0 | 1 | ||||

0 | 1 | 0 | 0 | 1 | ||

0 | 1 | 1 | ||||

1 | 0 | 0 | ||||

1 | 0 | 1 | 1 | 0 | ||

1 | 1 | 0 | ||||

1 | 1 | 1 | 0 | 1 |

Here *b* is hidden in the basis, either horizontal or rotated by 45 degrees.
Alice is sending a mixture of orthogonal states to confuse Bob, who can not
tell whether is receiving mixed
's and 's
or mixed 's and 's. It all will make sense,
however, when the list of initial polarizations is sent: he will have measured
50% of the particles with the correct basis, providing a certain measure. If
any of those turns out to be incorrect, he will know that cheating was involved.

Before the disclosure takes place, *B* gains no information at all from
the protocol, as illustrated by table 1. He could try to cheat by
using any arbitrary basis, but whatever measurements he does, the randomness
of
implies that he cannot guess the value of *b* before
the disclosure phase (table 2).

b |
b_{i} |
qubit sent | measurement basis | P(0 measured) | P(1 measured) |

0 | 0 | ||||

0 | 1 | ||||

1 | 0 | ||||

1 | 1 |

Due to the orthogonality of the measurement basis, we know that and also , so the probabilities of measuring 0 and 1 when

When *A* reveals the list of ,
*B* is able to confirm
that indeed all his measurements gave the right value for the approximately
times that *b*_{i} was equal to
.

Also, *A* cannot cheat, for table 3 suggests that whatever
she sends will have a probability equal to
of being caught
if she tries to make believe it was a zero, and of
if she tries to make believe it was a one (when it happens to be measured with
the aligned basis). The only way to be certain that *B* will accept the
protocol is to either make
by sending
and committing to zero or make
by sending
and committing to one.

qubit sent | measurement basis | P(0 measured) | P(1 measured) | |

0 | ||||

1 |

If *A* would be willing to take risks, she would face a situation as in
figure 2, where we have set
^{4}. With
for example, the probability of error is
for both measurements, so *A* would not be caught with
a probability of
which rapidly approaches zero when
the protocol is done with a sufficiently large number *s* of iterations.

This protocol looks as secure as Quantum Key Distribution, at a first glance. It does have a failure, however, as Bennett and Brassard realized from the beginning.